Better password security for new users

routes/auth.py

@@ -11,9 +11,19 @@ auth_bp = Blueprint('auth', __name__)
 def require_password_change(f):
     @wraps(f)
     def decorated_function(*args, **kwargs):
-        if current_user.is_authenticated and current_user.check_password('changeme'):
-            flash('Please change your password before continuing.', 'warning')
-            return redirect(url_for('auth.change_password'))
+        if current_user.is_authenticated:
+            # Check if user has any valid password setup tokens
+            has_valid_token = PasswordSetupToken.query.filter_by(
+                user_id=current_user.id,
+                used=False
+            ).filter(PasswordSetupToken.expires_at > datetime.utcnow()).first() is not None
+            
+            if has_valid_token:
+                flash('Please set up your password before continuing.', 'warning')
+                return redirect(url_for('auth.setup_password', token=current_user.password_setup_tokens[0].token))
+            elif current_user.check_password('changeme'):
+                flash('Please change your password before continuing.', 'warning')
+                return redirect(url_for('auth.change_password'))
         return f(*args, **kwargs)
     return decorated_function
 
@@ -280,6 +290,7 @@ def init_routes(auth_bp):
             # Log password setup event
             log_event(
                 event_type='user_update',
+                user_id=user.id,
                 details={
                     'user_id': user.id,
                     'user_name': f"{user.username} {user.last_name}",
@@ -290,7 +301,9 @@ def init_routes(auth_bp):
             
             db.session.commit()
             
-            flash('Password set up successfully! You can now log in.', 'success')
-            return redirect(url_for('auth.login'))
+            # Log the user in and redirect to dashboard
+            login_user(user)
+            flash('Password set up successfully! Welcome to DocuPulse.', 'success')
+            return redirect(url_for('main.dashboard'))
             
         return render_template('auth/setup_password.html')